Home: Why is there no 'dotnet nuget setApiKey' command?

[jamesqo]

I remember that before, I could write nuget.exe setApiKey XXX, and then do nuget push in a script without specifying my API key so other people couldn't see it in the script. Now, it's necessary to specify the API key as a parameter when you do dotnet nuget push, and there is no dotnet nuget setApiKey command. Is there a reason for this?

[PatoBeltran]

Hey @jamesqo thanks for your feedback. nuget.exe setApiKey was a simple command that only added the given api key (encrypted) to your nuget.config (which is read by the others nuget commands). There is no specific reason why it hasn't been ported to dotnet.exe. I will tag this issue as a feature request an send it to the backlog.

As a workaround you could use nuget.exe setApiKey (or set the values manually in your nuget.config and then use dotnet nuget push. dotnet.exe should read the nuget.config and use the api keys found there.

[dangershony]

FYI I had to go to \AppData\Roaming\NuGet\nuget.config and delete the previous key for the new key to take effect

[FlorianHockmann]

or set the values manually in your nuget.config

@PatoBeltran Is there any information on how the API key needs to be encrypted? What is used as the key to encrypt the API key?

[rrelyea]

I believe this might be similar to encrypting credentials...we don't have cross platform APIs for this available via Dotnet Core.

[FlorianHockmann]

So, it is really not possible right now to push NuGet packages to nuget.org on non-Windows platforms without Mono?

[lucastheisen]

@PatoBeltran ,

As a workaround you could use nuget.exe setApiKey (or set the values manually in your nuget.config and then use dotnet nuget push. dotnet.exe should read the nuget.config and use the api keys found there.

This does not appear to work. I tried:

nuget setApiKey <OMITTED> \
    -ConfigFile ~/.nuget/NuGet/Nuget.Config \
    -Source  https://pastdev.com/artifactory/api/nuget/pastdev-local

Verified it was added:

  <apikeys>
    <add key="https://pastdev.com/artifactory/api/nuget/pastdev-local" value="OMITTED" />
  </apikeys>

Then attempted a push:

bash-4.2$ dotnet nuget push artifacts/Pastdev.Cli.1.0.0.nupkg
error: Encryption is not supported on non-Windows platforms.

However, if i use use dotnet push -k

bash-4.2$ dotnet nuget push -k "<OMITTED>" artifacts/Pastdev.Cli.1.0.0.nupkg
info : Pushing Pastdev.Cli.1.0.0.nupkg to 'https://pastdev.com/artifactory/api/nuget/pastdev-local'...
info :   PUT https://pastdev.com/artifactory/api/nuget/pastdev-local/
info :   Created https://pastdev.com/artifactory/api/nuget/pastdev-local/ 502ms
info : Your package was pushed.

[zihotki]

Can confirm that it still doesn't work. Stumbled upon this issue and spent a lot of time trying to fix it without any good solution (-k option may work for command line but not for build scripts, api keys don't belong there).

[nojava4u]

Wow, one rabbit hole after another ... can't use apikeys for restore, only push; can't use the credentials for push only restore; apikeys can't be encrypted depending on platform; -k is only supported on push but not restore... in a CI/CD environment you end up with credentials AND apikeys in both your nuget.config AND your build/publish scripts... assuming you figure all this out.

[Caldas]

This is a mess, any plan for a real solution?

[NicolasDorier]

Please somebody fix this... :(

[another-guy]

I stumbled upon this github issue during my attempt to marry dotnet nuget to Azure DevOps. Is there any progress or update on this?

[NicolasDorier]

@another-guy I guess unless somebody can go to redmond and bang on the door of devs, nobody will look at it.

[jinweijie]

On Linux, the nuget version is quite old, not compatible with current nuget servers. So we have to use dotnet nuget push. But unfortunately, the setapikey is missing for the CLI, quite annoying. A workaround is to use environment variables, like:

dotnet nuget push ./nupkgs/*.nupkg -k $NUGET_AUTH_KEY -s https://api.nuget.org/v3/index.json

and in your .bashrc or .zshrc:

export NUGET_AUTH_KEY=oy12929292929292922....

[ckolumbus]

I'm using summon to inject all credentials as environment variables into the builds. Env variables work in most scenarios and summon helps me to keep secrets managed without the danger of accidentally committing them with my code.